Malicious PDF — malware analysis report

Static analysis result for SHA-256 49b0d45f9dcf152d…

MALICIOUS

PDF

62.7 KB Created: 2021-03-27 12:30:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 537918afa2214e968b89b6047d28a800 SHA-1: 249896675a614c14a12f36d2843b863f1aabf797 SHA-256: 49b0d45f9dcf152da4ec5f2ae0884bd00ec7361ec0508e90f402cd4a0d40f4ee
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file is identified as malicious by ClamAV and an ML classifier. It contains a significant number of external links, with one heuristic specifically flagging it as a 'PDF_SEO_LINK_FARM'. The document body, though heavily obfuscated, contains text related to 'Ielts speaking marking criteria pdf', suggesting a lure. The presence of embedded URLs and the overall structure point towards a phishing or content-farming scheme designed to distribute malicious or unwanted content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6622

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=ielts+speaking+marking+criteria+pdf
    • http://lozolupamo.mypressonline.com/dipemegame.pdf
    • https://xirejefeju.weebly.com/uploads/1/3/4/7/134723985/4591234.pdf
    • https://balikawe.weebly.com/uploads/1/3/4/6/134659528/lufowakuzazevaperub.pdf
    • https://sixumegeb.weebly.com/uploads/1/3/4/4/134476160/raruwofedixi_wurukuno_vibogitiz.pdf
    • http://vivekawiga.sportsontheweb.net/basketball_dictionary.pdf
    • https://nisazixipa.weebly.com/uploads/1/3/0/7/130775104/miwufuguxed.pdf
    • http://dawexefif.getenjoyment.net/1.garmin_nuvi_2597lmt_vehicle_gps.pdf
    • https://pefuxagofir.weebly.com/uploads/1/3/4/3/134359429/nepitodafamezurupa.pdf
    • https://bukowimulo.weebly.com/uploads/1/3/1/4/131407836/4980601.pdf
    • https://uploads.strikinglycdn.com/files/0018d95e-a5ee-4d49-809c-fd700ff3b2ef/2nd_grade_singular_and_plural_nouns_worksheets.pdf
    • https://uploads.strikinglycdn.com/files/2dfe3362-d013-46a8-9986-b47f83d156f1/rirexekanapabuzimenekeg.pdf
    • https://s3.amazonaws.com/gonasidupij/39094397773.pdf
    • https://uploads.strikinglycdn.com/files/aa2b38dd-ed24-41ec-9161-b206b2139b86/naloruxutil.pdf
    • https://uploads.strikinglycdn.com/files/f20a0ccd-68a9-4e37-91ff-de385b7b7952/dajulotav.pdf
    • http://gumusimigogasuz.onlinewebshop.net/nemuxagufomi.pdf
    • https://s3.amazonaws.com/sevoga/pusidadufod.pdf
    • https://uploads.strikinglycdn.com/files/1808d663-33c1-4650-baac-6ff00195cd2d/mn_dmv_road_test_schedule.pdf
    • https://s3.amazonaws.com/turip/sheet_metal_hydroforming_machine.pdf
    • https://s3.amazonaws.com/bezegoluzose/wujevikavusujobojutiwase.pdf
    • https://uploads.strikinglycdn.com/files/700b38ba-856b-4f94-99a9-692ecbf95bcd/tc_helicon_voicelive_2_with_vloop_price.pdf
    • https://uploads.strikinglycdn.com/files/cde95d2e-93a9-4548-a656-db3802373eec/ielts_writing_task_1_general_sample_answer_band_7.pdf
    • https://uploads.strikinglycdn.com/files/852438de-92a5-4e1c-8b06-0d980274302f/unitedhealthcare_mississippican_prior_authorization_form.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.